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1.0 BACKGROUND AND SUMMARY 


This report summarizes the testing and analysis of "single event clock upset" in the RH1020. Also 
included are SEU-rate predictions and design recommendations for risk analysis and reduction. 

The subject of ‘‘upsets” in the RH1020 is best understood by using a model consisting of a global clock 
buffer and a D-type flip-flop as the basic memory unit. The RH1020 is built on the ACT 1 family architecture. 
As such, it has one low-skew global clock buffer with a TTL-level input threshold that is accessed via a single 
dedicated pin. The clock signal is driven to full CMOS levels, buffered, and sent to individual row buffers 
with one buffer per channel. For low-skew performance, the outputs of all of the RH1020 row buffers are 
shorted together via metal lines, as is done in the A1020B. All storage in the RH1020 consists of routed flip- 
flops, constructed with multiplexors and feedback through the routing segments. A simple latch can be 
constructed from a single (combinatorial or C) module; an edge-triggered flip-flop is constructed using two 
concatenated latches. There is no storage in the I/O modules. 

The front end of the clock buffering circuitry, at a common point relative to the row buffer, is a sub-circuit 
that was determined to be the most susceptible to heavy ions. This is due, in part, to its smaller transistors 
compared to the rest of the circuitry. This conclusion is also supported by SPICE simulations and an analysis 
of the heavy ion data, described in this report. 

The edge triggered D flip-flop has two single-event-upset modes. Mode one, called C-module upset, is 
caused by a heavy ion striking the C-module’s sensitive area on the silicon and produces a soft single bit error 
at the output of the flip-flop. Mode two, called clock upset, is caused by a heavy ion strike on the clock buffer, 
generating a runt pulse interpreted as a false clock signal and consequently producing errors at the flip-flop 
outputs. C-module upset sensitivity in the RH1020 is essentially the same as that of its ACT 1 siblings 
(A 1020, A 1020 A and A1020B), which were well tested, analyzed, and documented in the literature. 
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RH1020 clock upset has not yet been detected directly by measuring a heavy ion induced pulse. 
Transmission of the clock signal via clock network interface hard macros, routing to an output module, and 
driving the signal off-chip can tend to act as a low-pass filter. A more sensitive “detector” are flip-flops 
constructed on the die, directly hooked to the global clock network. 

Detection and analysis relies on carefully designed test patterns and equipment to decompose the total 
number of flip-flop upsets into a C-module upset component and a clock upset component. Although in reality 
only the total upsets count, the separation is necessary because they have different frequency dependence and 
system effects. To a first approximation, the clock upset rate has a strong, linear dependence on clock 
frequency. The C-module upset rate is frequency independent (for all practically used frequencies). Since 
most applications use a clock frequency different from the SEU testing frequency, only the clock upset 
component has to be scaled to get an accurate rate prediction. 

Conclusions from the test data indicate that a heavy ion hitting on the clock buffer will induce “clock 
upsets” mainly when the clock signal is transitioning. A plausible scenario is the generation of a runt pulse on 
the positive going transition of the clock (with respect to the device pin). This can be interpreted by the flip- 
flops as two clocks or “double clocking,” as shown in Figure 1. The system affect is similar to other, familiar 
problems, such as ground bounce induced problems (see, for example, “High-Speed Digital Design: A 
Handbook of Black Magic”, by H. Johnson and M. Graham, Prentice Hall, 1993, page 69) or TTL-CMOS 
level translators constructed by adding a pull-up resistor to the output of a TTL device. 


Heavy ion induced negative pulse 



Figure 1 Double-clocking due to heavy ion induced pulse on clock 
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Clock upset has been detected in some previous Act 1 devices (see "Programmable Logic Application 
Notes/’ EEE LINKS, published by NASA/GSFC). RH1020 clock upset was initially found during QML SEU 
testing. It was then thoroughly investigated by heavy ion tests (four accelerator trips), laser stimulation, circuit 
simulation, and laboratory electrical evaluation. The most sensitive nodes were determined to be in the clock 
buffer. Heavy ion tests were performed, under identical conditions, on samples of all models of the A 1020 
series devices, confirming the earlier crude detection of clock upset susceptibility. 

Changes to the clock buffer circuitry to reduce the sensitivity to heavy ion upsets were done without 
negatively affecting the product characteristics or die size. SEU testing was performed on five (5) production 
parts with the new design changes. The clock upset data was extracted and is presented in this summary 
report. We found more than an order of magnitude reduction of clock upset due to the changes made resulting 
in clock upset rates being an order of magnitude smaller than one C-module flip-flop. Thus, the clock upset is 
minor when compared to the C-module upset for most applications. Nevertheless, for a customer to evaluate 
his/her application independently, we provide detailed data and methodology in this report to support the 
effort. 
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2.0 SEU TESTING AND RATE PREDICTION 


2.1 Test Set Overview 

The SEE test set used for this test consists of two sections, one set of equipment outside of the vacuum 
chamber and a DUT card mounted inside of the chamber. All power supplies are configured for remote 
sensing, ensuring accurate voltage settings at the DUT for all conditions. All I/O to and from the chamber is 
transmitted over RS-422 differential drivers and receivers, providing good noise immunity and reliable signal 
transmission. A 2X clock is sent to the DUT card, as are level commands. The DUT card sends back either 
raw data (in test mode) or error pulses. 

A laboratory computer controls the test and records the data. The PC is equipped with an HP-IB interface 
card for computer control of the HP6629A system power supply. Also embedded in the PC is a custom RS- 
422 board, providing command levels, a programmable frequency clock (via an external pulse generator or 
crystal oscillator selection), and ten (10) 16-bit event counters. 

Test control is provided through a WFI interface with real-time error counter display. Strip charts can be 
made of either device currents or error counters. For the clock upset tests, each mismatch triggered the 
recording and time tagging of the counters. Sampling was at approximately 4 kHz. 

The DUT card is a multi-layer PCB with all signals transmitted and received via RS-422 buffers. The 2X 
clock is divided down to a nominal 1 MHz by an on-board FPGA (A1020A). All pattern generation, DUT 
stimulation, and error-checking/error-pulse-generation is also performed by the FPGA. 
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2.2 DUT (Device Under Test) Design and Configuration 

The test pattern used for the majority of tests was the TMRA1BRB pattern, previously used on A 1020, 
A1020A, and A1020B devices. For clock upset testing, a subset of the device’s capabilities was used. 
Specifically, two 34-bit shift registers were used, one consisting of simple flip-flops and the other was a TMR- 
hardened (triple modular redundancy) string. Error monitoring circuitry is provided to count all upsets rejected 
by the error-correction circuitry. All flip-flops are constructed without any asynchronous preset or clear 
functions, eliminating upsets on other portions of the die as a possible cause of device error. 

The RH1020 is packaged in an 84-pin ceramic quad flat pack, surface-mounted to an adapter board. This 
multi-layer adapter includes power and ground planes and short lead lengths and is compatible with the 
A1460PGA207 socket on our test board. This configuration gives a good quality, realistic environment for the 
RH1020 and removes restrictions on beam angle to the device, a problem with the Wells ZIF socket normally 
used. Ground bounce and V cc spikes, measured at the RH1020 pins, was minimal and comparable to typical 
well-built systems. The clock was driven to full CMOS levels by an A1020A. The relatively moderate output 
transition times of this device resulted in clock signals, at the RH1020, which were clean and had minimal 
ringing. 

The input logic pattern to the shift registers was nominally a checkerboard pattern, i.e., an alternating ‘O’ 
and ‘I’ pattern at X A of the clock rate. Other patterns such as all ‘Ts, all ‘O’s, or twisted ring counters would 
mask the effects of clock upsets since the output signature would be difficult or impossible to distinguish from 
“normal” C-module upsets. The TMR string makes the D-latch part of the shift register practically immune to 
SEU, eliminating the upset component of the C-modules. 
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2.3 Clock Upset Detection 

A runt clock pulse or "double-clocking” by one heavy ion hitting a sensitive clock node will shift the 
internal flip-flops and the resultant output logic pattern out of phase by one state, for all flip-flops affected. A 
“full” extra pulse will result in all flip-flops receiving a clock pulse, with all flip-flops holding ‘0’s changing to 
M’s and vice versa. Checking circuitry, external to the RH1020, would then flag 34 errors on each string as a 
burst In practice, at device operating voltages of 4.5 VDC < V cc < 5.5 VDC, we normally saw error bursts of 
approximately 17 errors on each of the two shift register strings simultaneously , including the TMR-hardened 
string. Typically, zero or only a single error would be reported on the TMR error monitor, indicating that all 
flip-flops in the same region of the chip reacted identically to a runt pulse. 

To accomplish testing in reasonable times, most runs had ion fluxes of 10 5 ionsfcmVsec and a fluence of 
10 7 ions/cm 2 . While an estimate count could be made by watching the error counters, accurate clock upset and 
SEUs could be counted by our test equipment. To detect clock upset, our three error counters were monitored 
by the test computer at approximately 4 kHz. Any change to any of the counters resulted in each of the three 
counters being recorded and time stamped. By examining the change of error counts with respect to time, 
clock upset and all other mode of SEU are relatively easily separated and counted, even for high LET runs 
with a lot of upsets. Some typical data is presented below. 

Figure 2 Typical Data Showing Cumulative and Differential Error Counts 


1 MHz/Checkerboard 
LET = 34.4 



Sample Number 


Error Event Number 





2.4 Test Facilities and Conditions 

Most of the testing was performed at Brookhaven National Laboratory using the SEU facility in the 
Tandem Van de Graaff building. Other facilities included the cyclotron at Texas A&M and the pulsed laser 
facility at the Naval Research Laboratory. Electrical testing was performed at both the Actel Corporation and 
the NASA Goddard Space Flight Center. Typically, clock upsets were measured at 5 volts bias, 1 MHz clock 
frequency and room temperature with ion fluxes of 10 3 * * ions/cm 2 /sec and a fluence of !0 7 ions/cm 2 . The 
nominal V cc was used over the full range of LET. The voltage dependence of clock upset is too weak to 
establish the worst-case Vcc to be 4.5 volts or 5.5 volts. Additionally, several low-flux runs were conducted, 
with no major dependence on flux observed. 


2.5 Data and Rate Prediction 

Figure 3 shows the clock SEU cross section versus LET data plot of five (5) tested devices, 
P6-1 to P6-5. For a sample calculation, the median data are used to fit a Weibull curve by using 
HITFIT utilities in Space Radiation simulator with. The resulting Weibull parameters (Table 1) 
together with typical orbital, environmental and shielding parameters of a satellite on the 
geosynchrous orbit (Table 3) is then input to the heavy ions rates prediction module of the Space 
Radiation simulator. The result of the upset rate prediction is 3 x 10' 8 upsets/device-day. For 
comparison, the C-module upset rate in the same conditions is approximately 1 x 10' 7 upsets/bit- 
day. 

For a sample mission consisting of 10 RH 1020s for a duration of 10 years, the error rate is 
calculated to be: 

3 x 10’ 8 clock upsets/device-day x 10 devices/system x 10 years/mission 

or 


1 upset per thousand missions per system. 



Table 1 Weibull parameters 


Cross Section 


LET Threshold 


Weibull Width 



2 


Table 2 Environment/shielding parameters 


Orbit 

36,000 km, 0° 


100 mil A1 

Earth Shadowing 

Yes 

Magnetic Weather 

Stormy 

Solar Cycle 

Solar Min (1975, M=l) 


The frequency dependence of clock upset was measured using devices before the design 
changes were made to the clock buffer (After design changes, the upset counts are too low to 
make such measurements practical). Figure 4 shows the number of clock upsets versus the clock 
frequency of data from four parts, for a fixed fluence, measured at clock frequencies of 1 kHz, 10 
kHz, 100 kHz and 1 MHz. LET of 37. 1 to 74.2 MeV-cm 2 /mg and a V C c = 5 VDC and 4.5 VDC 
were used. The data clearly shows upset increasing with clock frequency. To a first order 
approximation, the upset rate can be treat as linearly proportional to the clock frequency. 
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Figure 3 Clock SEU results 

















3.0 DESIGN RECOMMENDATIONS 


3.1 Frequency Dependence 

The total upset in the device and its impact at the system level is somewhat dependent on the 
details of the design and application. However, since we can calculate the clock upsets and C- 
module upsets independently, the total upsets can be calculate unambiguously. To scale the 
clock upset, the computed rate from the SEU testing data has to be divided by 1 MHz and then 
multiplied by the clock frequency of interest. For a typical geosynchronous application, if the 
clock frequency is/ the clock upset rate is: 


/x 


3 x 10"® (upset / device - day) 
l(MHz) 



dock Frequency 


Figure 4 Frequency dependence of clock upset for a fixed fluence 
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To minimize a susceptibility to the global clock upset, the clock should be run at as low a 
frequency as possible. For certain critical registers the system designer may want to use a 
separate clock which is held inactive except when updating the register’s values. Based on 
available data and analysis, it is recommenced to hold the clock high at the device’s input pin. 

3.2 Redundancy Design 

If there is redundancy design for the clocked flip-flips, the redundancy should be designed 
across chips, if possible, similar to some memory EDAC architectures. It is preferred that 
redundant information not be stored in one single chip for the obvious reason that the global 
clock upset may simultaneously produce possible errors in all the clocked flip-flops. Separating 
redundant bits onto different chips may also decrease the number of single point failures (SPFs). 


3.3 Clock Upset Tolerant Design 

For extremely critical applications, clock upsets may be dealt with at the circuit level. For 
example, three input pins can be used, with the generated clock being the output of a majority 
circuit. Using the conclusion that the circuit is more susceptible during the period of the rising 
edge, two clock input pins could be ANDed together, requiring both signals to go high to switch 
the AND gate. For either techniques, note that the circuit outputs can not access the global clock, 
since in the ACT 1 family the network is only accessible via the dedicated device input pin. 


3.4 Clock Upset at System Level, Does Everyone Measure Clock Upset? 

The RH1020 is one of many device types, and similar questions about clock upset answered 
in this summary report should be asked for all digital devices in that system. Particularly 
important questions are: system flip-flop test methodology, flip-flop SEU rate frequency 

dependence, clock upset detection techniques, and separation of clock upsets and latch or flip- 
flop upset from the acquired data sets. Some “standard” testing techniques will not properly 
detect clock upset in devices. To date, the RH1020 has been, we believe, the most thoroughly 
tested CMOS device for this phenomenon that is available for space-flight electronics. 


10 



